MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd6639401fc329adb2d226b709b2d1ec96290e73f03d8c287f724d19b218ea63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bd6639401fc329adb2d226b709b2d1ec96290e73f03d8c287f724d19b218ea63
SHA3-384 hash:	720f3631d0403815b80e46ebae5022c64bc8a6d1ca606218333d4272100b78730ab8a94f4a35123d3f1e3e9799229658
SHA1 hash:	4fb547fd02ac7d5fd7254da93d729671fcadc0dd
MD5 hash:	902ad655a1ca2bdc70b0b5223d265613
humanhash:	wyoming-lemon-papa-lion
File name:	bd6639401fc329adb2d226b709b2d1ec96290e73f03d8c287f724d19b218ea63
Download:	download sample
File size:	2'775 bytes
First seen:	2026-08-14 08:37:54 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:dPM6KWXnXCh9IQ/jclzz90iP0hs/D/uJawhq3lszeJY9PlMWlyXmin2BuL6gM2TT:xM6R3yHxwl/97Ma/DWQLJCMWly5nVM2f
TLSH	T1CE51DF87B8A28D71226A84399B4BF1986677351B1835BC18BC9E74343F38164B9F47C6
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	c2hunter
Tags:	sh wraith

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

71

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.2650.28997.8331.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/6a7ed403e60273ae89d6757a/reports/2147f733-72d7-451f-9c64-87d44c93fcdc/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-14T06:41:00Z UTC

Last seen:

2026-08-14T07:41:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bd6639401fc329adb2d226b709b2d1ec96290e73f03d8c287f724d19b218ea63/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/692ff36d-3541-4913-a515-ae988c369248

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/bd6639401fc329adb2d226b709b2d1ec96290e73f03d8c287f724d19b218ea63

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bd6639401fc329adb2d226b709b2d1ec96290e73f03d8c287f724d19b218ea63/

ReversingLabs TitaniumCloud Linux.Trojan.Generic

Threat name:

Linux.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-08-14 08:38:33 UTC

File Type:

Text (Shell)

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xvtdsqa7ymu23mwse23qtmwr5slcsdtt6a6yykd7ojgrtmqy5jrq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

linux

Link:

https://tria.ge/reports/260814-kjydksyfjg/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/bd6639401fc329adb2d226b709b2d1ec96290e73f03d8c287f724d19b218ea63